Known in the art are devices, such as network protocol analyzers, which can capture a small portion of the traffic on a single path, cable, wire or route within a network, called a network segment. The major function of these devices is to analyze network behavior and more specifically facilitate diagnostic analysis. These devices generally operate by capturing a quantity of network traffic to memory or local storage, after which an operator may analyze the data in a variety of ways. Traditional network protocol analyzers have been developed around storage limitations. These devices are not suitable for capturing large quantities of network traffic, such as capturing all network traffic over the course of days or weeks at the main trunk of a WAN to Internet channel. Furthermore these devices do not provide redundancy, in that a failure of the device will cause a loss of traffic sampling. The sampled data is generally not made available externally to auxiliary devices, as that is not required for most diagnostic activities.
Prior to the invention it has not been possible to capture the network traffic over a segment over long periods of weeks or months. With the availability of capture data over long periods, many useful functions become possible that are not possible with limited protocol analyzers, three functions being provided here. First, it is more reasonable to find a malfunctioning network device if that device has an intermittent flaw that is rarely exhibited. Second it becomes feasible to track over a long period intrusions or an intrusive attempts from outside sources, the attempts intending to compromise security of network devices. This function may be especially desirable for network administrators, who are often not aware of these attempts until days or weeks after the occurrence. Third, it becomes possible to amass a quantity of data providing evidence of activity, for example, by criminal or terrorist groups and individuals that can be used for tracking or evidence in judicial proceedings.